Loading story…
Multiple incident reports show attackers repeatedly using exposed or weakly protected Remote Desktop Protocol (RDP) as both an entry point and an internal movement channel. In one intrusion, an actor brute-forced a local administrator account over RDP, created additional access, used Mimikatz to dump credentials and Kerberos tickets, and moved across systems before deploying an XMRig-based Monero miner. Separate reporting on Conti and other hands-on-keyboard operations shows similar post-compromise tradecraft, including credential theft, reconnaissance, use of remote management utilities, and abuse of legitimate Windows administration features to avoid dropping obvious backdoors.
Ransomware and espionage cases show the same pattern extending to interactive remote-control tooling beyond standard RDP. ASEC reported Crysis/Dharma and Venus ransomware actors brute-forcing RDP, stealing credentials, terminating processes, deleting shadow copies, and encrypting systems, sometimes retrying with a second ransomware family after a failed first attempt. North Korea-linked Kimsuky has also used RDP Wrapper, patched Terminal Services, VNC, Chrome Remote Desktop, Ngrok, and malware such as AppleSeed, Amadey, and RftRAT to maintain GUI-based access, evade user awareness, and support keylogging, file theft, and persistent control of compromised hosts.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
28 events from the most recent confirmed update back to the earliest known activity.
The LNK-based infection chains unpacked script malware that installed remote-access tools including XRat, Amadey, and RftRAT after compromise.
ASEC reported that in 2023 Kimsuky increasingly used malicious LNK shortcut files, rather than HWP or Office documents, for initial access against targets.
ASEC reports that AppleSeed has been observed since around 2019 as a recurring backdoor used by Kimsuky to install additional malware and remote-access tooling.
ASEC says TinyNuke source code was revealed in 2017, which enabled broader reuse of its capabilities by other attackers.
The ASEC report states that TinyNuke, later used by Kimsuky for HVNC access, was originally discovered as banking malware in 2016.
After gaining control of systems, Kimsuky used RDP or installed Chrome Remote Desktop to exfiltrate information and maintain remote access.
ASEC says recent Kimsuky variants of Amadey and RftRAT were created with or wrapped by AutoIt to hinder analysis and evade security products.
The attackers downloaded chromeremotedesktophost.msi and a batch script that ran remoting_start_host.exe with an attacker-generated authorization code and the PIN 230625.
ASEC says AppleSeed was used to deploy additional tooling including a browser credential stealer, an x64 RDP patcher for multiple sessions, and Ngrok for exposing systems behind NAT.
In the observed campaign, spear-phishing attachments disguised as Hangul, Office, or CHM files launched WSF or JS droppers that decoded and executed the AppleSeed backdoor.
ASEC reported that Kimsuky recently began abusing Chrome Remote Desktop to maintain browser-based graphical access to compromised systems.
ASEC says the ransomware operator installed Mimikatz and multiple NirSoft utilities for credential theft and reconnaissance, then used collected credentials and RDP to move to other internal systems.
In previously identified attacks, the actor first attempted to encrypt systems with Crysis and, when that failed, retried encryption using Venus.
According to ASEC, the actor used brute-force or dictionary attacks against weak RDP credentials, then logged in and installed both Crysis and Venus ransomware on victim systems.
ASEC discovered that a threat actor associated with Crysis ransomware was also deploying Venus ransomware in attacks that started through externally exposed RDP services.
The same report says Conti operators dump LSASS, use Mimikatz and other credential tools, spread with SMB admin shares and BITSAdmin, leverage AnyDesk and Atera, and may exfiltrate files to Mega.
Trend Micro reported that Conti intrusions can begin with phishing emails delivering BazarLoader or exploitation of public-facing firewalls using CVE-2018-13379 and CVE-2018-13374.
ASEC also observed Kimsuky distributing a customized tvnserver that supports reverse VNC without installing a service, enabling control from a C2-hosted viewer.
In the observed activity, Kimsuky enabled only TinyNuke's hidden VNC capability, allowing graphical control of infected systems without the user seeing the attacker session.
ASEC reported that Kimsuky used its AppleSeed backdoor to install VNC-based remote-control malware, including TinyNuke HVNC and a customized TightVNC implementation, on compromised systems.
About an hour into the intrusion, the actor deployed an XMRig-based Monero miner via svshost.exe, hid related files, and attempted outbound connections to known mining endpoints before disconnecting.
After access, the actor logged in from additional IPs, moved laterally over RDP to multiple systems including a domain controller, and used Mimikatz to dump credentials and export Kerberos tickets.
An account used in the intrusion was created the previous day from source IP 54.38.67.132, according to the DFIR Report.
The DFIR Report describes an intrusion in which an attacker brute-forced a local administrator password over RDP to gain initial access to the environment.
The ransomware payload 1pgp.exe was executed, encrypted the system, and left a ransom note; the sample was linked to Dharma/Crysis through a PDB path in the binary.
During the intrusion, the attacker ran shadow.bat and LogDelete.bat, terminated applications with closeapps.bat, and placed 1pgp.exe in Startup folders and a Run key for persistence.
At 09:36 UTC in the same intrusion, the attacker executed NS.exe from the desktop to scan and map file shares before ransomware deployment.
In the DFIR Report case, a ransomware operator linked to Dharma/Crysis logged in from IP 217.138.202.116 as a local administrator at 08:58 UTC.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
9 references tracked. Mallory keeps watching after this page renders.
asec.ahnlab.com
Open sourceasec.ahnlab.com
Open sourceasec.ahnlab.com
Open sourceasec.ahnlab.com
Open sourcetrendmicro.com
Open sourcethedfirreport.com
Open sourceasec.ahnlab.com
Open sourcethedfirreport.com
Open sourcethedfirreport.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors increasingly abused legitimate remote monitoring and management (RMM) software for initial access, persistence, credential theft, and defense evasion, with Huntress reporting that RMM abuse accounted for 24% of incidents it observed and surged 277% over the prior year. Campaigns used signed tools including **Action1**, **ScreenConnect**, **HeartbeatRM**, **AnyDesk**, **Atera**, and **SimpleHelp**, often chaining multiple products together to fragment telemetry and complicate containment. Delivery methods included phishing lures themed around the Social Security Administration and invitations, GitHub-hosted payloads, Cloudflare-protected sites, Windows-only filtering, and mobile-only credential harvesting pages; Huntress also observed low-maturity operators using LLM-generated scripts, VPS infrastructure, proxy tooling, combo lists, and utilities designed to hide RMM software from uninstall lists. Huntress also linked a sustained rise in compromises involving **Bomgar** instances to exploitation of **`CVE-2026-1731`**, a critical remote code execution flaw in BeyondTrust products, with attackers targeting outdated deployments to access victim networks and pivot into downstream customer environments. Reported incidents hit MSPs and software providers, including a ransomware attack affecting three downstream companies and another MSP breach that forced the isolation of 78 businesses while attackers moved into four customer environments. In affected networks, intruders created privileged accounts, added users to **Domain Admins**, ran reconnaissance with **NetScan** and **`nltest.exe`**, deployed suspicious drivers such as **PoisonX.sys** and **HRSword.exe**, and in several cases launched **LockBit** or a likely leaked-builder variant, underscoring the need to patch BeyondTrust systems, tightly govern trial and remote-access tooling, and monitor for unauthorized RMM activity.
Jun 29, 2026
Ransomware operators are increasingly leveraging legitimate remote access tools (RATs) such as AnyDesk, Splashtop, UltraViewer, AppAnywhere, RustDesk, CloneDesk, and TightVNC to facilitate their attacks and bypass traditional security measures. These tools, originally intended for IT administration and remote support, are being misused by cybercriminals to gain persistent, stealthy access to victim networks. Attackers exploit the fact that these RATs are often whitelisted and trusted within enterprise environments, allowing them to evade endpoint detection and response (EDR) solutions and other security controls. The use of legitimate RATs enables adversaries to connect to compromised systems without user interaction, transfer malicious binaries, exfiltrate sensitive data, and execute administrative tasks remotely. Encrypted communications provided by these tools further help attackers avoid network monitoring and detection. Security researchers have observed a trend where ransomware gangs prefer these off-the-shelf RATs over custom malware, as their legitimate signatures and widespread use make them less likely to raise suspicion. The abuse of these tools is often facilitated by poor configuration, lack of monitoring, or inadequate management within organizations. Once inside a network, attackers use RATs to move laterally, harvest credentials, and disable security defenses before deploying ransomware payloads. The sophistication of these campaigns has increased, with adversaries employing advanced evasion techniques and maintaining long-term persistence. Organizations are advised to review their use of remote access tools, ensure proper configuration, and monitor for unusual activity associated with these applications. Security teams should also consider implementing stricter application whitelisting and network segmentation to limit the potential impact of RAT abuse. The trend highlights the need for continuous vigilance and updated security policies to address the evolving tactics of ransomware operators. The exploitation of trusted IT tools for malicious purposes underscores the importance of balancing operational convenience with robust security oversight. As ransomware attacks continue to evolve, defenders must adapt their detection and response strategies to account for the abuse of legitimate software. The growing reliance on RATs by threat actors represents a significant challenge for organizations seeking to protect their networks from ransomware threats. Proactive monitoring, user education, and regular security assessments are critical components in mitigating the risks associated with the misuse of remote access tools. Failure to address these vulnerabilities can result in significant data loss, operational disruption, and financial damage due to ransomware incidents.
Jul 12, 2026
Russian and China-linked threat activity has relied on common but effective entry points to penetrate government, telecom, defense, energy, and other critical-sector networks. Ukrainian officials said CERT-UA recorded **5,927 cyber incidents** in 2025, a **37.4% increase** over the prior year, with Russian groups including **UAC-0002 (Sandworm)**, **UAC-0001 (APT28)**, **UAC-0010 (Gamaredon)**, and **UAC-0190 (Void Blizzard)** using exposed **RDP** services, vulnerable **VPN** appliances, supply-chain compromise, phishing, and stolen credentials to gain access. Separately, telecom intrusions tied to the China-linked cluster **UAT-9244** used exposed web applications, **ProxyLogon**, exposed **SSH** services, weak credentials, and unpatched server software to establish footholds in Linux-heavy environments. Once inside, the actors deployed a broad toolset for espionage, persistence, and disruption, including RATs, stealers, ransomware, wipers, and Linux malware such as **PeerTime**, which supports multiple architectures and uses peer-to-peer, BitTorrent-like communications to avoid reliance on centralized command-and-control. The reporting highlights exploitation of products including **Cisco ASA/AnyConnect**, **Roundcube**, **Fortinet**, **WinRAR**, **7-Zip**, and legacy Microsoft Office components, alongside social-engineering tactics such as **ClickFix**, device-code phishing, OAuth phishing, and QR-code hijacking. The campaigns also abused legitimate services and native system tools, while under-monitored embedded Linux devices, routers, edge systems, and container hosts were described as especially attractive for long-term persistence, lateral movement, scanning, and covert communications.
Jun 29, 2026